Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-06
CVE-2024-7876 - Before 1 Plugin
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2024-7876
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2024-5968 - Before 1 Plugin
The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2024-5968
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-8283 - Before 1 Plugin
The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 1
CVE-2024-8283
Risk Score
Threat Entry
Updated 2025-09-15
CVE-2024-7129 - Before 1 Plugin
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins
PLUGIN
Before 1
CVE-2024-7129
Risk Score
Threat Entry
Updated 2024-09-27
CVE-2024-6617 - Before 1 Plugin
The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2024-6617
Risk Score
Threat Entry
Updated 2024-09-27
CVE-2024-6493 - Before 1 Plugin
The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2024-6493
Risk Score
Threat Entry
Updated 2024-09-26
CVE-2024-6887 - Before 1 Plugin
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2024-6887
Risk Score
Threat Entry
Updated 2024-09-26
CVE-2024-5799 - Before 1 Plugin
The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privilege users such as Contributors to perform Cross-Site Scripting attacks.
PLUGIN
Before 1
CVE-2024-5799
Risk Score
Threat Entry
Updated 2024-09-25
CVE-2024-3899 - Before 1 Plugin
The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow users with post-writing privilege such as Author to perform Cross-Site Scripting attacks.
PLUGIN
Before 1
CVE-2024-3899
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-5561 - Before 1 Plugin
The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2024-5561
Risk Score
Threat Entry
Updated 2024-09-11
CVE-2024-6924 - Before 1 Plugin
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
PLUGIN
Before 1
CVE-2024-6924
Risk Score
Threat Entry
Updated 2024-09-11
CVE-2024-6925 - Before 1 Plugin
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
PLUGIN
Before 1
CVE-2024-6925
Risk Score
Threat Entry
Updated 2025-05-16
CVE-2024-3673 - Before 1 Plugin
The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.
PLUGIN
Before 1
CVE-2024-3673
Risk Score
Threat Entry
Updated 2025-05-27
CVE-2024-6459 - Before 1 Plugin
The News Element Elementor Blog Magazine WordPress plugin before 1.0.6 is vulnerable to Local File Inclusion via the template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
PLUGIN
Before 1
CVE-2024-6459
Risk Score
Threat Entry
Updated 2025-06-12
CVE-2024-6270 - Before 1 Plugin
The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2024-6270
Risk Score
Threat Entry
Updated 2025-08-22
CVE-2024-6477 - Before 1 Plugin
The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address
PLUGIN
Before 1
CVE-2024-6477
Risk Score
Threat Entry
Updated 2025-04-10
CVE-2024-6529 - Before 1 Plugin
The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 1
CVE-2024-6529
Risk Score
Threat Entry
Updated 2026-01-30
CVE-2024-6412 - Before 1 Plugin
The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
PLUGIN
Before 1
CVE-2024-6412
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2024-6408 - Before 1 Plugin
The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2024-6408
Risk Score
Threat Entry
Updated 2025-05-28
CVE-2024-3669 - Before 1 Plugin
The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 1
CVE-2024-3669
Risk Score